When your PMS provider is breached: what hotels should do

This week, an international hotel systems provider confirmed that unauthorised parties had extracted guest data from its platform. The provider serves several thousand hotels and accommodation businesses. According to the provider, names, contact details and booking information were accessed, while payment card data was not. The data is already being used in fraud attempts against guests.

The breach happened at the vendor, but responsibility does not stop there. Under the GDPR, the hotel is the data controller for its guests' data, and the vendor is the processor. The duty to notify, the guest communication and the risk assessment all sit with you.

Why this is more dangerous than it sounds

Leaked booking data makes fraud convincing. Guests receive emails, text messages or chat messages that refer to a real reservation: the right hotel, the right dates, the right room type. The link leads to a page showing the hotel and the room they actually booked. There they are asked to "confirm" or "update" their card to avoid losing the booking.

The fact that no card data leaked is little comfort when guests type their card number into a fake page themselves. That is why speed matters: the fraudsters are working while guests still don't know about the breach.

The first 24 hours

Don't wait for the vendor's final report. You can do all of this today:

1. Get written confirmation from the vendor. Ask which of your data is affected, what time period the breach covered, and whether access has been shut off. Request access logs for your property.
2. Rotate every key and password. That includes PMS users, API keys and integrations with your channel manager, payment provider, door lock system and booking engine. If the vendor has issued new keys to integration partners, check that all of yours have been replaced.
3. Turn on two-factor authentication for every user where available. Remove users who should no longer have access.
4. Brief front desk and reservations. Everyone answering phones or email needs to know what happened and what to say.
5. Notify guests with upcoming and recent stays first. They are most exposed, because the fraud relies on real reservations.
6. Watch your own channels. Look for fake websites, profiles and messages in your name. Alert your OTAs if fraudsters are using their messaging systems.
7. Document everything. Record when you became aware of the incident, what you did and why. You will need this for the data protection authority.
8. Report fraud attempts to the police and keep copies of fraudulent messages that guests forward to you.

What the law requires

You have 72 hours to report the breach to your data protection authority, counted from when you became aware of it. The deadline applies to the hotel as controller, not to the vendor. In the Nordics, that means Datatilsynet in Norway and Denmark, IMY in Sweden, and the Data Protection Ombudsman in Finland.

| Obligation | When | What | | --- | --- | --- | | Report to the authority | Within 72 hours | File a breach notification. If information is missing, report what you know and follow up with the rest. | | Notify guests | Without undue delay | Required when the breach poses a high risk to those affected. When the data is already being used for fraud, that threshold is met. | | Keep an internal breach log | Always | What happened, which data, consequences and measures taken. Applies even if you conclude notification is not needed. | | Demand information from the vendor | Now | The processor must notify you and assist. Check your data processing agreement for deadlines and content. |

If you are unsure whether to report, report. An unnecessary notification costs little. A late one can cost a lot. This overview is general information, not legal advice.

How to talk to your guests

Be early, specific and honest. Guests forgive a breach at a vendor more easily than silence from the hotel they stayed at. Three things must be in the notice:

• What happened, and which information is affected.
• One clear rule: the hotel never asks for card details via a link in email, text or chat.
• What the guest should do if in doubt, and whom to contact.

Send the notice from the hotel's own, known sender address. Don't include login or payment links. Otherwise your notice looks like the fraud you are warning against.

Sample message

Subject: Important information about your reservation at \[hotel name\] Dear guest, Our booking system provider has suffered a data breach. Guest names, contact details and booking information may be affected, including your reservation. To our knowledge, payment card details are not affected. Fraudsters are now using this kind of information to send fake messages that refer to real reservations and ask for card payment. [Hotel name\] never asks for card details via a link in email, text message, WhatsApp or booking platform messages. If you receive such a request, do not click and do not pay. Call us on \[phone number from your own website\] to check. If you have already entered your card details, contact your bank immediately to block the card and dispute the charge. We also recommend reporting it to the police. We apologise for this incident. We have reported the breach to the data protection authority and taken steps to secure our systems. Kind regards, \[Name, title, hotel\]

Also prepare a short version for text messages, and a standard answer front desk can give by phone.

Once the worst has passed

Vendor breaches will happen again. The question is how much is exposed when they do, and how quickly you find out.

• Review your data processing agreement. How quickly must the vendor notify you? Which subprocessors have access to the data? Where is it stored?
• Store less, for less time. Guest data from stays many years ago is pure risk. Set retention limits and check that they are actually enforced.
• Tighten access. Two-factor for everyone, individual accounts per employee, and least privilege per integration.
• Protect your domain. SPF, DKIM and DMARC make it harder to send email that appears to come from your hotel.
• Teach guests one fixed rule. Put it in the booking confirmation: how and where the hotel requests payment, and how it never does.
• Have an incident plan. Who does what, who calls the vendor, who writes to guests, and who reports to the authority. Rehearse it once a year.

Final word

You can outsource the running of a system, but not the responsibility for your guests' data. The hotels that come out of this week best are the ones that notify quickly, speak plainly, and use the incident to hold their vendors to a higher standard.